Lesson 3: Wireless Authentication and Device Hardening

Core path: 42 minutes

Security configuration should reduce unnecessary exposure while preserving legitimate work.

Today we connect wireless authentication, workstation hardening, and mobile-device security.

Wireless security

WPA2 and WPA3

WPA2 and WPA3 are modern Wi-Fi security standards used to protect wireless communications under supported configurations.

Avoid obsolete WEP and weak/deprecated configurations.

TKIP vs AES

TKIP is an older encryption mechanism associated with legacy WPA/WPA2 compatibility.

AES-based protection is the modern preferred direction for supported WPA2/WPA3 deployments.

Do not keep weak settings simply because an old device cannot support the current standard without documenting the risk and replacement need.

Enterprise authentication concepts

Recognize:

• RADIUS — commonly provides centralized AAA services for network access;
• TACACS+ — centralized AAA commonly associated with administrative access to network devices;
• Kerberos — ticket-based authentication used in many domain/enterprise environments;
• MFA — adds independent authentication evidence.

A strong Wi-Fi passphrase and centralized user authentication solve different problems.

Workstation hardening

Data at rest

Use approved encryption to protect stored data when a device or drive is lost/stolen.

Password policy

Organizations may define:

• minimum length;
• allowed/required character types;
• uniqueness/history;
• complexity;
• expiration/rotation policy where applicable.

Technicians follow current policy rather than inventing arbitrary rules.

Firmware passwords

BIOS/UEFI passwords can help restrict firmware/configuration access on supported devices. Protect recovery/administrative procedures.

Screen/session protection

Use:

• screen saver/automatic lock;
• logoff where appropriate;
• timeout/screen lock;
• protection of passwords and PII;
• password managers where approved.

Account restrictions

Recognize:

• least permissions;
• allowed login times where policy uses them;
• disable guest account;
• failed-attempt lockout;
• account expiration;
• change default administrator name/password where appropriate.

Reduce unnecessary execution/exposure

• disable AutoRun where policy requires;
• disable unused services;
• do not leave unnecessary privileged services listening/running.

Mobile-device security

Device encryption

Protects stored data when a locked/powered-off device is lost, assuming keys/access controls are protected.

Screen locks

Recognize:

• facial recognition;
• PIN;
• fingerprint;
• pattern;
• swipe at recognition depth.

A simple swipe may not provide strong authentication depending on platform/configuration.

Configuration profiles and MDM

Organizations can use configuration profiles and Mobile Device Management to enforce settings such as:

• passcode requirements;
• encryption;
• Wi-Fi/VPN;
• application restrictions;
• certificates;
• update policy;
• remote actions.

Patch management

Both the mobile OS and applications need supported updates.

Endpoint protections

Depending on platform/policy:

• antivirus/anti-malware;
• content filtering;
• application restrictions.

Lost-device controls

Recognize:

• locator applications/services;
• remote wipe;
• remote backup;
• failed-login restrictions.

A remote wipe is a high-impact action and requires authorization plus awareness of backup/recovery state.

BYOD vs corporate-owned

Bring Your Own Device and corporate-owned models create different ownership/privacy/management expectations.

A corporate security profile on a personal device should be governed by explicit policy, not improvised by a technician.

Student action

Build two hardening checklists:

1. staff Windows laptop;
2. organization-managed smartphone.

For each include:

wireless/auth method:
encryption:
account/session rule:
update rule:
unused feature/service reduction:
management profile/MDM:
lost-device control:
tradeoff:
verification:

Evidence checkpoint

Hardening is not "turn everything off." It is reducing unnecessary risk while keeping the required system usable and recoverable.